Dark Reading Daily -- August 03, 2022

Thousands of Mobile Apps Leaking Twitter API Keys

New finding comes amid report of overall surge in threats targeting mobile and IoT devices over the past year.

VirusTotal: Threat Actors Mimic Legitimate Apps, Use Stolen Certs to Spread Malware

Attackers are turning to stolen credentials and posing as trusted applications to socially engineer victims, according to Google study of malware submitted to VirusTotal.

Massive New Phishing Campaign Targets Microsoft Email Service Users

The campaign uses adversary-in-the-middle techniques to bypass multifactor authentication, evade detection.

Microsoft Intros New Attack Surface Management, Threat Intel Tools

Microsoft says the new tools will give security teams an attacker's-eye view of their systems and supercharge their investigation and remediation efforts.

5 Steps to Becoming Secure by Design in the Face of Evolving Cyber Threats

From adopting zero-trust security models to dynamic environments to operating under an "assumed breach" mentality, here are ways IT departments can reduce vulnerabilities as they move deliberately to become more secure.

Capital One Breach Conviction Exposes Scale of Cloud Entitlement Risk

To protect against similar attacks, organizations should focus on bringing cloud entitlements and configurations under control.

T-Mobile Store Owner Made $25M Using Stolen Employee Credentials

Now-convicted phone dealer reset locked and blocked phones on various mobile networks.

Average Data Breach Costs Soar to $4.4M in 2022

Call it a "cyber tax": Those costs are usually passed on to consumers, not investors, as compromised businesses raise prices for goods and services.

Name That Toon: Modern-Day Fable

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

How Risk-Based Vulnerability Management Has Made Security Easier

Trying to remediate everything was never a winning strategy. RBVM is an approach that gets organizations better results with less effort.

Chromium Browsers Allow Data Exfiltration via Bookmark Syncing

"Bruggling" emerges as a novel technique for pilfering data out from a compromised environment — or for sneaking in malicious code and attack tools.

LATEST FROM THE EDGE

Overcoming the Fail-to-Challenge Vulnerability With a Friendly Face

Ahead of their Black Hat USA talk in August, Simon Pavitt and Stephen Dewsnip explain the value of helping people practice cyber defense via a "malicious floorwalker" exercise.

LATEST FROM DR TECHNOLOGY

Large Language AI Models Have Real Security Benefits

Complex neural networks, including GPT-3, can deliver useful cybersecurity capabilities, such as explaining malware and quickly classifying websites, researchers find.

Implementing Zero Trust In Your Enterprise: How to Get Started